Security of coherent state quantum cryptography in the presence of Gaussian noise 
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We investigate the security against collective attacks of a continuous variable quantum key distri- 
bution scheme in the asymptotic key limit for a realistic setting. The quantum channel connecting 
the two honest parties is assumed to be lossy and imposes Gaussian noise on the observed quadra- 
ture distributions. Secret key rates are given for direct and reverse reconciliation schemes including 
postselection in the collective attack scenario. The effect of a non-ideal error correction and two-way 
communication in the classical post-processing step is also taken into account. 

PACS numbers: 



I. INTRODUCTION 



The goal of quantum key distribution (QKD) is to dis- 
tribute a key between two honest parties, usually caUed 
Ahce and Bob, which is provably secure against any 
eavesdropper Eve. It is assumed that Eve is only limited 
by the laws of physics. From a practical point of view, im- 
plementations using coherent states as input signals and 
variations of homodyne [H, [2, [3, 0, B IB] detection seem 
to be promising, since they can readily be realized exper- 
imentally. Moreover, it has been suggested that homo- 
dyne detection can be performed at high repetition rates 
in continuous variable (CV) QKD to boost the secret key 
rate The securityof these schemes has been investi- 
gated before Q, 0, 0, [O, E El, Q d and uncon- 
ditional security has been proven for losses of up to 1.4 
dB [l^. Though advancing our understanding of these 
schemes, no analysis has been provided that would give 
an unconditional secure key over channels with higher 
losses or channels imposing excess noise on the observed 
quadratures. In this article we will present an analysis 
that derives a security result under the assumption of 
collective attacks and the observation of Gaussian noise. 
The result is derived in the infinite key limit, thus ig- 
noring statistical effects. Though restricted in this sense, 
there are strong indications that these restriction can be 
lifted, so that our results, if successfully combined with 
other results will lead to the desired unconditional secu- 
rity. We expect this will be a fair representation of the 
(still missing) full unconditional security proof. We com- 
pare different techniques of extracting a secret key from 
shared classical data such as postselection (PS) and re- 
verse reconciliation (RR). Moreover, our approach can be 
modified to include two-way communication in the clas- 
sical post-processing step of the protocol and non-ideal 
error correction. 

Any QKD protocol can be thought of consisting of two 
phases. The goal of the first phase is to distribute an 
effectively entangled state between Alice and Bob [13, 
ITsj . This entanglement does not need to be present in 
actual physical systems. Instead, it can be brought in 



as a theoretical construct |17l [19| , as explained in more 
detail in Sec. III. In practise, Alice and Bob will use a 
prepare-and-measure scheme, where Alice encodes some 
bit-value i into non-orthogonal signal states. She sends 
a sequence of n such states over the quantum channel 
to Bob. In general, Eve might interact coherently with 
these n states. We restrict ourselves here to the case 
of collective attacks, where Eve attaches an independent 
probe to each signal. Then the total state shared between 
Alice and Bob will be of tensor product form Pj^- 

Eve, however, may keep her quantum states pE,ii 
which summarize all her knowledge about the sent sig- 
nals until the second phase of the protocol is completed. 
In this phase, Alice and Bob use an authenticated but 
otherwise insecure classical channel to correct for errors 
in their bit-strings and to cut out Eve's knowledge about 
the key (privacy amplification) (20| . The information sent 
over the classical channel becomes available to Eve who 
then can optimize her collective measurements on the 
quantum states. For this scenario of collective attacks, 
we apply the generic approach by Devetak and Winter 
[2l| to give a lower bound on the secret key rate. 

The security analysis presented here applies to the sit- 
uation where the quantum channel connecting Alice and 
Bob is lossy with single-photon transmittivity rj and im- 
poses Gaussian excess noise 5 on the quadrature distri- 
butions. This kind of noise is typically seen in the exper- 
iments [12, nil . It has been shown that a distillation of 
a secret key in CV-QKD is only possible when 



(5 < 2?7 , 



(1) 



because otherwise the correlations between Alice and Bob 
could have originated from a separable state [7|. Here, 
the excess noise 5 is determined via homodyne measure- 
ments. It can easily be verified that our calculated lower 
bounds on the secret key rate for the various types of 
protocols are well in the regime of quantum correlations. 

In this article, we compare different approaches to dis- 
till a key for a CV prepare-and-measure scheme. We as- 
sume that the quantum channel between Alice and Bob 
can be verified to be Gaussian through tomographic com- 
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plete measurements and that Eve is restricted to collec- 
tive attacks. While the observation of a Gaussian chan- 
nel is certainly a restriction, it should be noted that this 
scenario is typically encountered in practise. Moreover, 
recent work (24 i25j indicates that the Gaussian attack 
might be optimal for the non-postselected protocols con- 
sidered here. However, it is still an open problem to re- 
late this result to protocols including announcements and 
postselection. Furthermore, there is hope to find a quan- 
tum de Finetti like argument [26] valid in the regime of 
continuous variables to extend the security against collec- 
tive attacks to unconditional security, as this can already 
be done in finite dimensions. Since we are only interested 
in the key rate in the asymptotic limit, we do not con- 
sider any finite size effects in our analysis. A complete 
security proof would have to resolve these issues. 

We consider a protocol where Alice uses coherent states 
as signals and send through Eve's domain to Bob, who 
performs a heterodyne measurement onto the received 
states. It is known that one can improve the secret key 
rate if one introduces reverse reconciliation (RR) [l|, 
This means that Bob decides on a raw key based upon his 
measurement results and consequently sends Alice cor- 
rection information over the public channel in the error 
correction step of the protocol. Another way to improve 
the performance of the protocol is to employ postselec- 
tion (PS) 14]: Bob only retains measurement outcomes 
that are closely correlated to Alice in order to gain some 
advantage over Eve. This approach can lead to positive 
secret key rates for direct reconciliation (DR) schemes 
beyond the so called 3dB loss limit [27[- Since both ap- 
proaches are not mutual exclusive, we consider combina- 
tions of DR and RR with PS. If one takes a realistic error 
correction protocol into account, it has been shown that 
it is necessary to introduce a postselection step in the 
RR protocols to retrieve the initial advantage that RR 
has over DR [H. 

This article is organized as follows. In Sec. II we in- 
troduce the QKD protocol under investigation. Then 
we describe the state distribution scheme in an entan- 
glement based scheme. The fact that state distribution 
in our protocol can be seen as Alice and Bob perform- 
ing tomographic complete measurements lets us restrict 
Eve's knowledge about the signals. This is applied to the 
Gaussian noisy channel in the next section. In Sec. V 
we modify our protocol and let Alice and Bob partially 
announce their measurement outcomes. This defines in- 
dependent effective binary channels. Next, we calculate 
a lower bound on the secret key rate for each binary 
channel independently. The last section contains the nu- 
merical optimized secret key rates and our conclusion. 



II. THE PROTOCOL 

We consider a prepare-and-measure scheme where Al- 
ice encodes her bit value into the modulation of co- 
herent states I a) as signals. The complex amplitude 



a = ax + ioiy is chosen at random according to a sym- 
metric Gaussian probability distribution 

= 7^e~^ , (2) 

centered around the origin. Alice's assigns her signal the 
bit value (1) if the real part of the sent amplitude is 
positive (negative). The states \a) are then sent through 
Eve's domain to Bob. Bob performs a heterodyne mea- 
surement on the received states p^, which is mathemat- 
ically equivalent to a projection onto a coherent state 
1/3) — \Px + 'iPy)- He obtains the measurement outcome 
(3 with probability 

p{P\a) = -{P\p%m (3) 

TT 

and assigns a bit value (1) whenever his measurement 
outcome Px is positive (negative). 

After Bob has measured out the received states, Alice 
announces partially the amplitude of the sent signals as 
a = {\ax\,ay} and Bob announces respectively partially 
his measurement outcome as b = {\Px\, Py}- As we will 
see in Sec. V, this announcement will enable us to de- 
compose the problem into effective independent binary 
channels. 



III. REPLACEMENT OF THE SOURCE AND 
COMPLETE TOMOGRAPHIC MEASUREMENTS 

The starting point of our analysis is that we rephrase 
the state preparation step in the prepare-and-measure 
setup in an entanglement based way. This can be done by 
supplying Alice with a suitable source of entangled states. 
One part of the entangled state is kept by Alice whereas 
the other part is sent through the quantum channel to 
Bob. This scheme is a valid description of the prepare- 
and-measure scheme, if a measurement performed by Al- 
ice onto her part of the entangled state effectively pre- 
pares the desired conditional state of the prepare-and- 
measure scheme with the proper a priori probabilities. 
As we show later, this can be done for the protocol in- 
troduced in the previous section. Moreover, both mea- 
surements performed by Alice and Bob turn out to be 
tomographical complete in our case. 

After preparing n entangled states, Alice and Bob 
share the state p^g, since we restrict Eve to collective 
attacks. Without loss of generality one can assume that 
Pab originates from a pure three party state I'^abe)- 
Eve holds the purifying environment ps of pab which 
summarizes her knowledge about the distributed states. 

As we restrict ourselves to the case when both mea- 
surements performed by Alice and Bob are tomographic 
complete, they can in principle reconstruct their shared 
state PAB- However, we skip details of the tomography 
in our analysis as we are only interested in evaluating 
the secret key rate in the asymptotic limit as n — s- cx). 
Therefore, the security analysis presented here can be 
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considered as incomplete. The aim is to investigate what 
the rate one can expect to find assuming that one solves 
the additional steps involving the estimate of the state 
shared by Alice and Bob. 

From the purity of state \'^abe) it follows from 
Schmidt's decomposition that pab = trE\'^ABE){'^ABE\ 
and pe = ^t^abI"^ abe) abe\ have the same eigenval- 
ues. Eve's reduced density matrix pE is then determined 
up to an arbitrary unitary operation on her system by 
the state tomography. This in turn completely deter- 
mines Eve's knowledge about the distributed signals. 

In the following we apply this kind of analysis to our 
protocol from Sec. II in a realistic scenario. 



quadrature-' measurements. The quadrature operator x 
is defined as x = -^{a + a^), where d and d^ is the 

photon annihilation and creation operator. As a further 
assumption, we suppose that the channel adds the same 
amount of noise in both quadratures, so that Bob effec- 
tively verifies that he receives displaced thermal states as 
conditional states, denoted by pg. Then the probability 
of Bob getting the measurement outcome (3 conditioned 
on Alice sending a coherent state with amplitude a is 
given by Eq. ^ as 

7T(2 + 0) 



IV. APPLICATION TO THE GAUSSIAN 
CHANNEL 

It has been shown by Grosshans et al. Q that Al- 
ice's state preparation can formally be described in an 
entanglement based scheme. It corresponds to a situa- 
tion where Alice has a source under her control that pro- 
duces two-mode squeezed states |Cas')- If Ahce performs 
a heterodyne measurement onto her part of the state, 
she effectively prepares a coherent state in the B' system 
with Gaussian a priori probability. As the source of two- 
mode squeezed states is under her control, she can choose 
a suitable squeezing parameter so that she indeed effec- 
tively prepares coherent states with the proper a priori 
probability ([2]) . The part B' of the state is then passed to 
Bob through Eve's domain. Bob performs a heterodyne 
measurement on the received state. Since this measure- 
ment is tomographical complete, we can directly apply 
the reasoning of the last section to this specific protocol 
and obtain the state in Eve's hand. 

For the state tomography step, it is worth noting that 
Alice's reduced density matrix pA — trpAB is fixed by 
preparing coherent states |a) with the a priori probabil- 
ities given by Eq. One can therefore parameterize 
Alice's subsystem by the variance k of the probability 
distribution p{a). Moreover, it suffices to check the con- 
ditional states pg to estimate Eve's interference with the 
signals. However, we do not consider arbitrary noise im- 
posed by Eve on the conditional states, but limit our 
security analysis to a scenario which is typically encoun- 
tered in experiments: we assume that the states Bob re- 
ceives are attenuated by the loss rj in the quantum chan- 
nel and the conditional probability distributions p(/3|a) 
as given by Eq. ([3]) still have Gaussian form but are 
broadened by a factor 

the so called excess noise. Here, A'^^^P^ denotes the ob- 
served variance of the classical probability distribution 
([3]) and A^^^fix is the corresponding variance of the vac- 
uum. We have included the factor 2 so that our definition 
of the excess noise matches the one given in Ref. 7] via 



Since Bob's subsystem can be characterized by the esti- 
mated channel parameters, the total bipartite state pab 
is given by the input variance k, the excess noise S and 
the loss T]. As mentioned before, the knowledge pab 
determines Eve's quantum state pE up to an arbitrary 
unitary operation on her system when complete tomo- 
graphic measurements are available. It then follows that 
Eve's knowledge about the signals is fixed by the set of 
parameters k, rj and i5. Therefore, all attacks performed 
by Eve give her exactly the same amount of information 
about the signals as long as the channel can be verified to 
be Gaussian. In particular, this means that attacks like 
the entangling doner [1] or the amplifier attack [l^ 
are equivalent in this setting and Eve retains the whole 
purifying environment. Recent results concerning the op- 
timality of Gaussian attacks, when the full tomographic 
information is not available, can be found in [23.|25|. 

Here one can pick a specific attack to construct Eve's 
ancilla system pE^ which is only restricted in the sense 
that the conditional states that Bob receives are ther- 
mal states and Eve retains the whole purifying environ- 
ment of p%. On the other hand, the joint probability dis- 
tribution p{a, (3) of Alice preparing an input state with 
amplitude a and Bob obtaining a measurement outcome 
j3 is fixed by the state tomography. It follows that Eve's 
conditional states |e"'^) already contain all her knowl- 
edge about the distributed signals. These states are pure, 
since they can be thought of originating from a projec- 
tion measurement of the pure three party state |^'ab_e)- 
Equivalently, Eve's information can also summarized in 
the matrix of all possible overlaps {e°''^\e"' ). 

We will proceed to calculate a lower bound on the se- 
cret key rate with the specified discretisation to bit- values 
of continuous outcomes (3 and a. It turns out that in this 
case Eve will effectively have to distinguish non-Gaussian 
states on an infinite dimensional Hilbert space to infer the 
bit-value. Since this is hard to solve in general, we ap- 
ply an approach to define effective binary channels as we 
have already done in [2^ and let Alice and Bob partially 
announce a and (3. This partial knowledge will become 
available to Eve, who then only needs to distinguish two 
nonorthogonal states on a two dimensional Hilbert space, 
so that we can evaluate easily all related quantities. 
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V. EFFECTIVE BINARY CHANNELS 

The security analysis presented here is Umited to the 
cohective attack scenario, so that the bipartite state be- 
tween Ahce and Bob after n uses of the quantum chan- 
nel is simply Pj^- Consequently, Bob's measurement 
outcomes /3 on subsequent signals are independent. Sup- 
pose now that Alice announces the modulus of the real 
part \ax\ and the imaginary part ay of the prepared am- 
plitude a = ax + iay. Now Bob knows that the state he 
receives can only originate from the two possible states 
|±|ax| -I- iay) and that in each distributed state one bit 
of classical information is encoded. Each distribution of 
a signal between Alice and Bob corresponds to the use of 
an effective binary channel defined by Alice's announce- 
ment and Bob's measurement. From Eq. ^ follows that 
both possible input states occur with equal probability. 
The probability of Alice making a certain announcement 



{V 



j} can be directly calculated form Eq. ([2]) as 



p{a) = p(+\ax\ + iay) + p{-\ax\ + iay) 



'^P{\<^x\ + iay) 



1 _M 

— e 2k 



(6) 



Bob performs a heterodyne measurement on the received 
state. The probability that he gets the measurement out- 
come (3 after the announcement of Alice can be calculated 
from Eq. ([5|) as 



p{P\a) 



p(/3|a,0)p(o,0)+p(/3|a,l)p(a,l) 
pia,0)+p{a,l) 

i(p(/3|a,0)+p(/3|a,l)) , 



(7) 



where we have characterized the two possible values for 
the amplitude a = ±|aa;| -f iay by the encoded bit-value 
or 1 and the announcement a. The conditional prob- 
abilities for Bob obtaining the measurement result /3 for 
given announcement a are directly given by ^ as 



Pif3\a,0) 



p(/3|a,l) 



2 -2 

e 



71(2 + 6) 



2 -2 

e 



7r(2 + (S) 



2 + 5 



(gx + v^l<:.xl)^ + (<3y-V^e.y)^ 
2+^ 



(8) 



Similar to the announcement of Alice, we let Bob record 
the measured /3 for each signal and publicly announce 
b ^ {\Px\,f3y}- From Eq. ^ follows that 

p{+\Px\ + iPy\a) = pi-\l3x\ + iPy\a) , 

so that the probability for Bob making an announcement 
b given Alice announced a is 



p{b\a)^2p{+\Px\+il3y\a). 



Both announcements of Alice and Bob for a given dis- 
tributed state will then define one effective binary chan- 
nel. Furthermore, the error probability for Bob assigning 



the wrong bit-value can be computed from 

+ P{b,+\a, 1) 

^ ~ p{b,+\a,0)+p{b,+\a,l) 



(10) 



where we have chosen to describe Bob's measurement 
outcome (3 by the announcement b and the sign of the 
measured /3a:, which corresponds to Bob's decision on a 
bit-value. Respectively the error probability e~ when he 
obtained a negative sign for the measured (3x is given by 



p(6,-|a,0) 



p(&,-|a,0)+p(&,-|a,l) 



(11) 



From Eq. ([5|) follows that each effective binary channel 
defined by the announcements of a and b is symmetric in 
the error rate, since 



e ' = e = e 



e{\axim) = 



1 



8v^|QxII/3x 

■ e 2+5 



(12) 



1 



holds. Each distributed state between Alice and Bob 
with announced a and h therefore corresponds to the use 
of an effective symmetric binary channel with error rate 
e as given by (jl2p . Each information channel contributes 
an amount of 1 — _ff to the mutual information between 
Alice and Bob, whereas H^™ is the entropy of a binary 
symmetric channel, 

ijbin(g) ^ _g i^g^(g) - (1 - e) log2(l - e). (13) 

The total mutual information between Alice and Bob 
Ia:B can be calculated as a sum over all effective binary 
channels weighted with the appropriate probabilities (O 
and (O as 



I A. 



A:B 



d\ax\ 



X / d\l3x 
h 



day p{a)x (14) 

DC 

dpy p{b\a) [1 - H^- (e)] . 



Since the error rate e only depends on the announced 
values of \(3x\ and \ax\ one can carry out parts of the 
integration analytically to simplify (fH|) as 



I A. 



A:B 



d\ax\ p(\ax\)y- 



(15) 







oo 



X / d|/3,|p(|/3,|||a,|) [1-Hi^'"(e)] 
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The total probability p(|/3j;|||q!j;|) that Bob announces a 
particular value \l3x \ for a given announcement a of Alice 
can be derived from (O and ^ as 



(9) p{m\w.\) 



TT (2 -f ,5) 



dpy p{b\a) 

2+^ 



(16) 



2(10x1- v^IQxI)^ 

e 2+^ 



5 



and the probability that AHce announces \ax\ follows 
from ^ as 



P{Wx\) 



Aayp{a) 



(17) 



We have now quantified the mutual information between 
Alice and Bob. As mentioned before, Eve's information 
about the signals is summarized in holding conditional 
quantum states |e"'^). The announced values of a and h 
give her partial information about the distributed signals. 
In particular, she knows the effective binary channel that 
has been used by Alice and Bob and the error rate e of 
that channel. In other words. Eve knows for a given an- 
nouncement of a and h that she holds a convex combina- 
tion of the four possible states |eQ'!j.), |eo'-)j ki +)' ki''^) 
in her ancilla system, where (1) corresponds to an en- 
coded bit- value (1) by Alice and -I- (— ) to Bob obtaining 
a positive (negative) measurement outcome for fix- The 
state e°''^ that Eve holds for a given announcement {a, 6} 
can thus be written as 



(1-e) (kS,+>(4+l + ki;->(ei;-l) 

+e(ka:->(4'-l + ktt>«+l^ 



(18) 



The state e^'^ can be interpreted as a uniform mixture of 
states corresponding to different encoded bit-values 



/ a, 6 , a,6\ 



(19) 



or as a uniform mixture of states corresponding to differ- 
ent signs of the measured [3x 



1 / a. 



b , a,b 



(20) 



with 



a.b 


(1 


\ 1 a, 6 \ / a.b \ 

~e)\eo,+){'^o,+ \ 


I 1 a,b \ 1 a,b \ 




a.b 


(1 


\ 1 a.b \ 1 a,b \ 

-e)|ei;_)(ei._| 


1 1 a.b \ 1 a.b 1 




a.b 

e+ = 


(1 


\ 1 a.b \ / a.b \ 

-e)|eo;+)(eo;+| 


1 1 a.b \ 1 a.b \ 

+ eki.:+>(ei;+l 




a.b 

e_ ~ 


(1 


^ 1 a.b \ 1 a.b i 


1 1 a.b \ 1 a.b \ 

+ eko,->(eo,-l • 


(21 



If Eve wants to infer the encoded bit-value, she effectively 
has to distinguish the states eg'^ and e°'^. This case is 
common in QKD and we refer to it as direct reconciliation 
(DR). As already mentioned, there exists an inequivalent 
way to distill a key from exchanged quantum states in 
CV-QKD: with the use of strict one-way communication 
in the classical post-processing step of the protocol, one 
can force Eve to infer Bob's measurement outcome rather 
than the encoded bit-value. This method is called reverse 
reconciliation and was first pointed out by Grosshans [l|, 
1^ . For the specific protocol investigated here this means 



that Eve has to discriminate e"''' and e"'" for a given 
effective binary channel in the RR schemes. 



VI. LOWER BOUND ON SECRET KEY RATE 

The aim of this article is to compute a achievable lower 
bound on the secret key rate for our specified prepare- 
and-measure QKD using coherent states. By now we 
have shown that Eve's knowledge about the distributed 
signals, given a certain effective binary channel is used, 
is summarized in the quantum states ep'* and e"''' for the 
DR schemes or e!^''' and e'^'' when RR is applied. In the 
following, we use a result by Devetak and Winter [2ll |. 
which gives a lower bound on the secret key rate as a 
function of the states that Eve has to distinguish. This 
approach is valid in the collective attack scenario and 
one-way classical post-processing. Then the secret key 
rate G is bounded from below by 



G > Ia:I 



X 



(22) 



with X being Holevo's quantity [29|. Since we investigate 
a practical QKD scheme with a specified measurement 
setup, we have replaced the Holevo quantity between Al- 
ice and Bob in theorem (1) of ^] by the classical mutual 
Information Ia-.b- The Holevo quantity x is defined as 



(23) 



i=0 



i=0 

where S{p) — — tr (plog2p) denotes the von Neumann en- 
tropy and the pi are the states that Eve needs to distin- 
guish. The announcements of a and h divide the state 
distribution into independent binary channels. It follows 
that we can apply the bound ((23|) to each effective bi- 
nary channel defined by the announcement of a and h 
separately. The contribution to the mutual information 
between Alice and Bob per use of an effective binary 
channel is 1 — ff^'"(e), where the binary entropy 7J'^'"(e) 
is given by Eq. (jl3p . An upper bound for Eve's informa- 
tion about the signals for a given announcement can be 
written according to Eq. (^5)) as 



Xda = S{e )-- 



S 



^a,b 



s 



(a, I 
^1 



(24) 



when the key bit is determined by Alice's encoding pro- 
cedure as in the DR schemes or as 



a,b 

Xrr 



S 



s 



(25) 



when a RR scheme is applied. We have used that the 
a priori probabilities pi = ^ in a given effective binary 
channel for both RR and DR, as can be seen from Eqs. 
p9)) and (|20p . Hence we have to calculate the von Neu- 
mann entropies of the states defined in Eqs. and 
(PT|) to bound Eve's knowledge about the key. A lower 
bound can then be obtained with the help of Eqs. 
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([9]) and ((T3)) by summing over all independent effective 
binary channels as 

/•OO /"OO /"OO 

G> d\a^\ / da.yj5(a) / d|/3,|x (26) 

JO J-oo Jo 

/OO 
d/3,p(6|a){[l-Hb-(e)] -X'''"} , 
-OO 

where the Holevo quantity x°"^ is given by Eq. ((24|) in 
the DR schemes and by Eq. (PS)) in the RR case. In the 
following we will explicitly calculate the Holevo quanti- 
ties for these two types of protocols for a lossy and noisy 
Gaussian quantum channel. 



VII. EVE'S INFORMATION 

We have pointed out that all collective attacks that 
Eve might perform on the distributed signals are uni- 
tarily equivalent if the quantum channel between Alice 
and Bob can be verified as being symmetric and Gaus- 
sian, assuming that Eve retains the whole purifying en- 
vironment. It is convenient to pick a specific attack with 
these properties to estimate Eve's knowledge about the 
distributed signals. Here, we have chosen the entangling 
doner attack Q to carry out the calculation. In this at- 
tack. Eve taps off the signals sent by Alice with a beam- 
splitter and feeds one half of a two mode squeezed state 
in unused port of the beam-splitter. In doing so, the sig- 
nals become attenuated according to the transmittivity 
of the beam-splitter and she introduces Gaussian excess 
noise on Bob's side. The amount of squeezing she uses 
in preparing her two mode squeezed state relates to the 
excess noise seen by Bob. More specifically, the state 
shared between Eve and Bob conditioned on Alice send- 
ing a coherent state \a) can be constructed via 

\n,E) = RB,EMSE,.EAO\a)B\0)EA0)E, , (27) 

with 

i?s,i;i(^) =ef(^"i'^-^''='i) (28) 
SE^^EAO^e-^"'''"'''^^'"'"' , 

whereas Ei, E2 label the modes in Eve's hand, Sei,E2{C) 
denotes the two-mode squeezing operator with squeez- 
ing parameter ^ = re"^ as can be found, for example, 
in Ref. [s^l- The unitary Rb,Ei{0) is associated to a 
beam-splitter with transmittivity rj via the identification 
yffj = cos(|). The operators 6, e'l and €2 are the bosonic 
anihilation operators associated with the modes Ei , E2 
and B. From this, one can calculate Bob's received states 
by tracing out Eve's subsystem. It is easy to see that from 
Bob's point of view Eve effectively injects a thermal state 
in the beam-splitter so that Bob will observe Gaussian 
noise. The amount of excess noise 5 is related to the 
squeezing parameter ^ = re*"'' as i5 = 2 sinh^r(l — 77). 



From Eq. (|27|) . one can calculate Eve's states \e"'^) 
conditioned on Alice sending a coherent state |a) and 
Bob obtaining the measurement outcome fi by projecting 
|\E'1 ^) onto 1/3). As before, we relabel the state |e"'^) in 
terms of the announcement {a, 6}, the encoded bit-value 
i e {0, 1} and the sign of Bob's measurement outcome 
k G {+,— } as |e°'^.). Since Eve's system is fixed up to 
an arbitrary global unitary on her system by the tomog- 
raphy step, it is sufficient to calculate the matrix of all 
possible overlaps (e^f |e"f) to estimate Eve's knowledge. 
It turns out that the overlaps can be written as 

«^k;^> = (29) 

/ 1 Be"*"* Ae'''' ABe'-^-^'t' \ 

Be"!' 1 ABe*'^+*'* Ae"^ 

Ae-"-"^ ASe"*'^-*'* 1 BBe-"!' 

\ ABe-''!'+"l' Ae-''^ Be*"* 1 j 

(30) 

with 

A = e"K(i-Ti.)) (31) 
B = c^if^iih) , 

One can get rid of the phase factors depending on (f> and 
tp by multiplying the states by appropriate phase 

factors. This is possible, since we are only interested in 
the construction of states of the form 

p = ^p(^fc)l<,')(<,'l, (32) 

i,k 

as can be seen from Eqs. and (pij) . The states p are 
obviously invariant under this transformation. 
The matrix of overlaps (|29p is then of the form 

/I B A AB\ 

, a.b, a.b. i B 1 AB A \ 

\^i,k I - \ A AB 1 B \ 

\AB A B 1 / 

From that it follows that one can write the states |e"'^) 
as 

k-i> = kr'>kf) (34) 

with 

(e^-'lef ) =^ = e-("'(i-Ti^)) (35) 
(ef le^'") = i?-e-(^^TT7), 

where we already replaced the squeezing parameter ^ by 
the excess noise i5 observed by Bob. 

Since the states under investigation can be written as 
a product ([M]) of two states in two dimensional Hilbert 
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spaces, one can expand them as 

lelJ'") =co|$o)+ci|<i>i) (36) 

|6f)-co|<i>o)-ci|<i>i) (37) 

and 

|ef)^c+|$+)+c_|$_) (38) 

|e!_''')=c+|$+)-c_|$_) , (39) 

where |$o) and |$i) form a set of orthonormal basis 
states for the Hilbert space spanned by {cq'^) and le"'''). 
Respectively |$+) and |$_) form an orthogonal basis for 
the space spanned by |e!^'^) and \e°2'')- The coefficients 
Co, ci, c+ and c_ depend on the effective binary chan- 
nel labeled by a and b, though we suppress these indices 



now to simplify the notation. It is important, however, 
to keep in mind that we estimate Eve's knowledge about 
the signals for each effective channel independently. The 
normalization condition reads 

|co|' + |ci|' = |c+|' + |c-|' = l. (40) 

and 

|col'-|cir = (eo''kf>=^ (41) 

is fixed by the overlaps ([35|) . In this basis the state e"'^ 
of Eq. (fT5|) can be written as 



\co\'\c+\' 
IcoPlc.p 

(1 — 2e)cQCic*^c 
(1 — 2e)cQCic*^c- 

which has the eigenvalues 

1 



(1 - 2e)coclc+c*_ 
(1 — 2e)cQC*iC+c*_ 
\ci?\c+? 
\ci?\c-? 



^3,4 



IcoHc^p + IciHc+p ± v/(|coP|c-P + |ciP|c+P)2 _ I6e(l - e)\c,\^\cA^\c,\^\c+V 



Icohc+I^ + \c,\'\c.\' ± V(|coP|c+P + \c,?\c-?r - 16e(l - e)|coP|c_P|ciP|c+| = 



(42) 



(43) 



r 



so that we can calculate the first term of Eqs. ((24l) and 
([25]) with the help of Eqs. (gSl) , gj) , (gQl) and ^ via the 
equation 

Sie'-') = -Y^Wog^K . (44) 

i 

The explicit expression is omitted here. 

A. Direct reconciliation 



bit-value encoded by Alice. These can be expressed in 
product form ([M)) as 



a.h I a.h\ i a,b\ ^ /-i \| a,6\ / a.fci . i a.b\ i a,b\ 

=ko X^o I® (l-e)|e+ )(e+ |+e|e_ )(ej I 

a,b I a,fe\ / a,b\ 



(45) 



1 =ki >(ei l® (l-e)|e_ )(ej |+e|e+' I 



In the DR protocols. Eve has to discriminate the states With the help of the basis states |$o), and 1$+), 
Eq''' and t^f' as defined in Eqs. (I^T]) in order to infer the I"!"-) these states can be written as 




It is easy to see that there exists a unitary U with t^^ = the state eg'^ can be obtained by first diagonalizing the 
Uel'''U\ so that S{e^'''') = S'(e^'^). The eigenvalues of 
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sub-matrices and then taking the tensor product. Then 

a,b 1 

Eg reads, 



a,fc _ / 1 

~ I 



A? 
AO 



(47) 



in its eigenbasis. The eigenvalues A? 2 are given by 
A?,2 - ^ (1 ± Vl-16e(l-e)(|c+nc_|^)) . (48) 



so that the entropy 5(eQ''') can be computed with the help 
of Eqs. (ini), gll) and dM]) and Eve's knowledge 

about the distributed signals in the DR protocol is upper 
bounded by 



where again the explicit expression is omitted. 



(49) 



B. Reverse reconciliation 



In the RR schemes, the key bits are determined by the 
sign of Bob's measured Px component. Hence, Eve has to 
discriminate the corresponding states e'^^ and e"''' ([2T|) 
for a given effective binary channel. These can be written 
with the help of Eq. as 



a,b I a,b\ / a,b\ ^ /i \i a.(J\ / , i a,t)\ / a,t)\ 



a,b\ / a^b i 



(50) 



I a.b\ I a,b\ 

e_ )(e_' 



In the \^o), |$i) and \^+), |<f>-)basis, these states read 



|c+| 
clc- 



|c+| 



|co| (l-2e)c^ci 
(l-2e)c|co \cif 



(51) 



|c+l 
-clc- 



|2 



|co| -(l-2e)coCi 
-(l-2e)c^co |ci|' 



r 



Similar as in the previous subsection, the states e"''' and 
6°''' are unitarily equivalent, so that it suffices to calcu- 
late S{e'^'') to determine the upper bound ((25|) of Eve's 
information about the signals for the RR protocols. The 
eigenvalues Af 2 of turn out to be 



The total secret key rate can thus be calculated as a sum 
over all binary channels according to Eq. ([26]) . Since 
neither the mutual information (1 — H^™) between Alice 
and Bob nor Eve's information x'^'^ depend on the an- 
nounced values of ay and (3y, one can simplify Eq. 



A+2 = ^1 ± \/l-16e{l-e){\cof\c^f)j , (52) 

so that we can easily estimate Eve's knowledge about the 
distributed states with the help of Eqs. (|5^ and (|^^ as 



(53) 



VIII. 



SECRET KEY RATE AND 
POSTSELECTION 



By now, we have calculated the individual terms of an 
upper bound x"''' on Eve's information about the raw 
key for DR and for RR protocols, given that an effective 
information channel is used. We have also shown that 
the mutual information shared between the two honest 
parties per effective binary channel labeled by the an- 
nouncement of a and b is given by 1 — TJ*^'", with H^"^ 
being the entropy of a symmetric binary channel p3p . 



G> / d\ax\p{\ax\) / d|/3,|p(|/3,|||a,|)x 
Jo Jo 

X [1 - H*^- (e) - x^'"] 



d|a,|p(|a,|) / d|/3,|p(|/3,|||a,|)A/(a,6) , 
Jo 

(54) 



where the probabilities pda^^j) and p(|/3a;| | \ax\) are given 
by Eqs. 0\ and (fTC]) . 

The term A/(a, 6) quantifies the average information 
theoretic advantage of Alice and Bob over Eve for a given 
effective channel. Since we have calculated this quantity 
for all channels separately, we can improve the perfor- 
mance of the protocols by dismissing effective channels 
whenever A/(a, b) is negative and hence Eve knows more 
about the distributed signals than Alice and Bob. This 
procedure is called postselection. Even in absence of 
noise, a postselection procedure is for example necessary 
to lead to a positive secret key rate beyond 3 dB losses for 
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FIG. 1: Optimal values for the input variance k vs. loss 
1 — 77 for various protocols. All graphs shown correspond to 
an excess noise 5 of 2%. 

the DR protocols . For RR schemes, all effective binary 
channels contribute a positive amount to the secret key 
rate, if one only takes losses in the quantum channel into 
account [2^. In this scenario, postselecting the measure- 
ment outcomes cannot improve the secret key rate. This 
is however no longer true if the channel imposes excess 
noise S on the signals, so that postselection can improve 
the performance of the RR schemes in this more general 
setting. 



IX. NUMERICAL RESULTS AND DISCUSSION 

Now we have everything at hand to evaluate the secret 
key rate G numerically. For a given excess noise S and 
transmission rj we can optimize the input variance k for 
best performance. Optimal values for the input variance 
K are given in Fig. ([1]). For numerical purposes, we 
restrict ourselves to vary the variance k between 0.1 and 
3. The optimal variance k diverges in the limit 77 — > 1. 
Apart from that, the optimal variances fall well inside 
the region in which we optimize k. 

Fig. ^ shows our results for the RR and the 
postselected DR scheme. As expected, the secret key 
rate G decreases with increasing excess noise 5 = 
{0,0.02,0.04,0.06,0.08,0.1}. However, the noise affects 
the non-postselected RR scheme much stronger than 
the postselected DR scheme (PS-DR). The RR protocol 
looses most of its initial advantage even for a low excess 
noise of 2 %. This can be counteracted by introducing 
a postselection step in the RR protocols, as proposed in 

After introducing a postselection step in the RR 
scheme (PS-RR), the protocol performs more robustly 
against increasing excess noise 6, as can be seen in Fig. 
([3]). Now the PS-RR scheme performs better than the 




10"' r 



. I , I , I , I ^ 1 I , u 

0.2 0.4 0.6 0.8 1 

10SS=]-T1 



FIG. 2: Comparison of the secret key rate G versus loss l — rj 
for the PS-DR (dashed lines) and the RR (solid lines) scheme. 
The secret key rates shown correspond to an excess noise 5 
of {0,0.02,0.04,0.06,0.08,0.1} and decrease with increasing 
excess noise. 




loss 1-Tl 



FIG. 3: Combination of postselection and reverse recon- 
ciliation. Secret key rates G are plotted for the PS-DR 
(dashed lines) and the PS-RR (solid lines) protocols and ver- 
sus the channel loss 1 — rj. The excess noise 5 varies as 
5 = {0,0.1,0.2,0.3}. 



DR counterpart for all values of the excess noise, though 
the behavior of the secret rate gets more and more similar 
for increasing excess noise. This shows again that it is ad- 
vantageous to combine postselection with reverse recon- 
ciliation for best performance in the presence of Gaussian 
noisy quantum channels. However, here we assume that 
all observed excess noise occurs in the quantum channel 
and can therefore be exploited by Eve. As a benchmark, 
one can tolerate an excess noise of about S = 0.2 if the 
quantum channel has 50% transmittivity. It follows that 
the applicability of the protocols is very limited with this 
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conservative assumption. 



A. Two-way communication 

The security analysis presented here assumes that the 
communication between Alice and Bob in the classical 
post-processing step is strictly one-way. From a practi- 
cal point of view however, it is favorable to give lower 
bounds to the secret key rate G for two-way communi- 
cation, since these kind of protocols can easily be im- 
plemented with known error correction procedures like 
CASCADE. In principle, the bound ([^ requires one- 
way communication to be used. This can be circum- 
vented however, if one reveals all information to Eve that 
is in principle obtainable by an eavesdropper when two- 
way classical post- pro cessing is used. Following earlier 
treatment in Ref. |3l| , one can assume for two-way er- 
ror correction the worst-case scenario in which the pre- 
cise position of the errors in Bob's data become publicly 
known. Then it does not matter anymore, whether Alice 
or whether Bob make subsequent announcements. Note 
that in CASCADE, Bob's announcements are completely 
determined by the error position, and therefore no longer 
need to be taken into account when calculating the cost 
of error correction. Given this knowledge. Eve can up- 
date the state e"-^ ^ that summarizes her knowledge 
about the distributed signals and the remaining commu- 
nication can be chosen to be one-way. Then Eq. ((22l) 
is again valid, but the states e"^'' now include this addi- 
tional information. It follows that Eve either holds the 
state 

C'c™ = ^(ko;t>(4'tl + kt->(4'-l) (55) 

or 

<^-L--^(ko;->(4'-l + l<+>(4il) (56) 

in her ancilla system. Obviously, the probability that an 
error in the bit assignment occurs is given by e. It is then 
easy to show that Eve's information about the signals for 
a given announcement (a, h) is bounded by 

X2 — way '^Xcrror ^" (-^ '^)Xno error (5'^) 
= eS (forror) + (1 " (fno error) > 

whereas the second line follows from the fact that here 
Eve has to distinguish pure states. Furthermore, since 

^no error ^^'^ ^orror ^^'^ unitarlly equivalent, S (Cerror) = 

^ (^ncferror) ^-^^ 

a.b ^ a (a,b \^G(fa,b \ /ro\ 
A2— way V error/ V no error/ " \^^/ 

The entropy S (cno'error) is given by the eigenvalues 
^2-u)aa q£ e°^^(,j,^Qj. It is straight forward to show 

that these are given by 

Xl--'^y = \co\'\c^\' + \c^\'\c+\' (59) 




loss 1-ri 



FIG. 4: Secret key rates G for postselected protocols and two- 
way communication (solid lines) in comparison to the one- 
way PS-DR protocol (dashed lines). The excess noise 5 varies 
between and 0.1 as in Fig. For (5 = 0, the curve for 

two-way communication coincides with the one for the PS-DR 
protocol. 



with |coP, |c„p, |cip, |c+p implicitly given by Eas. (HD|) 
and (|iT|). 

Figure (j4]) shows our numerical results for the secret 
key rate G with two-way communication in comparison 
to the postselected DR results. If there is no channel 
excess noise S present, we recover our previous result 
that the DR-PS rate coincides with the two-way rate [28j . 
Moreover it can be seen that the knowledge about the er- 
ror positions does not improve Eve's position significantly 
in our analysis. Even in the presence of excess noise 6, 
the DR-PS rate gives a good approximation to the two- 
way bound. A practical implementation using two-way 
error correction codes like CASCADE will therefore yield 
a secret key rate close to the one-way DR-PS rate. 



B. Practical error correction 

We extend our analysis presented here to a more re- 
alistic scenario and take the effect of a non-ideal error 
correction procedure into account. 

The key rate ([5^ gives the theoretical achievable key 
rate if a perfect error correction procedure is available. 
In practise however, error correction codes that work ex- 
actly at this so called Shannon limit [s^ are not known. 
Realistic error correction codes, like CASCADE [s^ work 
close to that limit. This can be included by modifying 
Eq. dSll) as 

poo poo 

G> / d\a^\p{\a^\) / d|/3,|p(|/3,|||a,|)x 
Jo Jo 

X [1 - /(e)Hb- (e) - x""''] , (60) 
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e 


fie) 


0.01 


1.16 


0.05 


1.16 


0.1 


1.22 


0.15 


1.32 



TABLE I: Efficiency of Cascade [s^ for different values of the 
error rate e 



T 
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FIG. 5: Secret key rates G for postselected protocols using 
the two-way error correction scheme CASCADE (solid lines). 
For comparison, key rates for the PS-RR protocol with one- 
way codes, that are as efficient as CASCADE are also shown 
(dashed lines). The excess noise S varies between and 0.1 
as in Fig. (Hjl . 

where the function /(e) represents the efficiency of the 
error correction procedure and is a function of the error 
rate e. As a benchmark, we assume that the used error 
correction is as efficient as CASCADE. For our numerical 
evaluation, we therefore use a linear fit to the values given 
in TablelH For two-way communication. Eve's knowledge 
X"'^ in Eq. is given by Eq. ([55)1 . Following this ap- 
proach, we can give secret key rates which are attainable 
with todays technology. Numerical results are shown in 
Fig. §1. 



Reverse reconciliation clearly requires one-way commu- 
nication. On the other hand, developing practical and 
efficient one-way codes is still work in progress. It is 
therefore interesting to see how much secret key rate one 
would gain if one applies a one-way code that is as ef- 
ficient as CASCADE. This can easily computed via Eq. 
(ISO)) whereas is given by Eq. (P0|) for the DR protocol 
or by Eq. for the RR scheme. 

Fig. ([5]) shows also a comparison between two-way 
protocols and PS-RR. The error correction procedure is 
assumed to have the same efficiency as CASCADE. It can 
be seen that one-way PS-RR has a significant advantage 
over the attainable two-way protocol only for very low 
values of the channel excess noise S. This indicates that 
the development of efficient one-way codes, as currently 
under investigation by several groups, will significantly 
benefit RR protocols if the channel excess noise can be 
assumed to be of the order of a few percent. 



X. CONCLUSION 

In conclusion, we have addressed security issues for a 
CV-QKD scheme in a practical setting. It is important 
to include a postselection procedure in both the RR and 
DR schemes to ensure that the protocols perform robust 
against Gaussian excess noise. 

We have shown that a implementation using two-way 
error correction yields a secret key rate close to the rate 
of the one-way direct reconciled protocol. As the ex- 
cess noise increases, the secret key rates for the one-way 
direct or reverse reconciled protocols become more and 
maore similar to the ones obtainable by two-way com- 
munication. Finally, we compute the secret key rate for 
a protocol that is readily implementable using the error 
correction code CASCADE. 
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